ISO 22301 Certification
ISO 22301 helps organisations prepare proactively for crises – from natural disasters and IT failures to supply chain disruption – so they can maintain critical activities and recover as quickly as possible after a disruption.
Why business continuity management?
In a globalised economy, small businesses and large corporations alike are vulnerable to events beyond their control: natural disasters, pandemics, political instability, cyber attacks or IT system failures. Growing reliance on technology, outsourcing and international partner networks means that even a crisis far away can directly affect domestic operations.
A Business Continuity Management System (BCMS) based on ISO 22301 helps organisations move from reacting to preventing, limiting financial and non-financial losses and avoiding disruptions that could threaten their very existence.
Key content of ISO 22301:2019
ISO 22301:2019 shares the high-level structure of ISO management system standards. Its operational core includes:
- Business impact analysis (BIA): identifying critical activities, impacts over time and recovery time objectives (RTO)
- Risk assessment of disruption to prioritised activities
- Business continuity strategies and solutions, covering resources, people, technology and suppliers
- Plans and procedures for incident response, communication and recovery
- Exercising and testing at planned intervals to confirm the plans work
Guidance on the BCMS is given in ISO 22313. In February 2024 ISO published ISO 22301:2019/Amd 1:2024 on climate action: clause 4.1 now requires the organisation to determine whether climate change is a relevant issue, and clause 4.2 gains a note on interested parties' climate-related requirements.
Two key concepts in the BIA are the maximum tolerable period of disruption (MTPD) and the recovery time objective (RTO), with the RTO set within the MTPD. ICT readiness for business continuity is covered in more detail by ISO/IEC 27031.
Who it is for and certificate validity
ISO 22301 suits any organisation that wants to ensure continuous delivery of its products and services: banks, insurers, telecoms, IT service providers and data centres, manufacturers, logistics, healthcare and operators of essential infrastructure.
Through an audit by TÜV NORD experts, your organisation receives an independent assessment of the effectiveness and reliability of its BCMS. The certificate issued after a successful audit is valid for three years, with annual surveillance audits confirming that the standard's requirements continue to be met. ISO 22301 can be combined with ISO/IEC 27001 and ISO/IEC 20000-1.
Benefits for your organisation
Effective crisis response
Tools and plans are ready to handle incidents, crises or disruptions in an organised way.
Shorter downtime
Helps reduce downtime and recovery time, limiting costs and losses.
Comprehensive risk management
Disruption risks are identified and controlled at every level of the organisation.
A reliable partner
Give customers independent evidence that your ability to keep delivering in difficult circumstances is systematically managed.
How it works
- Enquiry, scope definition and quotation
- Contract signing and audit planning
- Stage 1 audit: review of BIA, risk assessment and BCMS documentation
- Stage 2 audit: effectiveness of plans, exercises and improvement
- Independent review and certification decision
- Issue of a certificate valid for three years
- Annual surveillance audits
Frequently asked questions
How does ISO 22301 differ from an IT disaster recovery plan?
How long is an ISO 22301 certificate valid?
What is a business impact analysis (BIA)?
Do we have to exercise our business continuity plans?
Related services
Talk to our experts
Contact TÜV NORD Vietnam in Hanoi, Ho Chi Minh City or Vung Tau for detailed information on ISO 22301 and a quotation for your organisation.
Contact us